Sync from SUSE:SLFO:Main xz revision 264c904c90900e46626e7ef836f67df4

xz.changes

@@ -1,3 +1,135 @@
+-------------------------------------------------------------------
+Thu May 30 06:08:18 UTC 2024 - Paolo Stivanin <info@paolostivanin.com>
+
+- Update to 5.6.2:
+  * Remove the backdoor (CVE-2024-3094).
+  * Not changed: Memory sanitizer (MSAN) has a false positive
+    in the CRC CLMUL code which also makes OSS Fuzz unhappy.
+    Valgrind is smarter and doesn't complain.
+    A revision to the CLMUL code is coming anyway and this issue
+    will be cleaned up as part of it. It won't be backported to
+    5.6.x or 5.4.x because the old code isn't wrong. There is
+    no reason to risk introducing regressions in old branches
+    just to silence a false positive.
+  * liblzma:
+    - lzma_index_decoder() and lzma_index_buffer_decode(): Fix
+      a missing output pointer initialization (*i = NULL) if the
+      functions are called with invalid arguments. The API docs
+      say that such an initialization is always done. In practice
+      this matters very little because the problem can only occur
+      if the calling application has a bug and these functions
+      return LZMA_PROG_ERROR.
+    - lzma_str_to_filters(): Fix a missing output pointer
+      initialization (*error_pos = 0). This is very similar
+      to the fix above.
+    - Fix C standard conformance with function pointer types.
+    - Remove GNU indirect function (IFUNC) support. This is *NOT*
+      done for security reasons even though the backdoor relied on
+      this code. The performance benefits of IFUNC are too tiny in
+      this project to make the extra complexity worth it.
+    - FreeBSD on ARM64: Add error checking to CRC32 instruction
+      support detection.
+    - Fix building with NVIDIA HPC SDK.
+  * xz:
+    - Fix a C standard conformance issue in --block-list parsing
+      (arithmetic on a null pointer).
+     - Fix a warning from GNU groff when processing the man page:
+      "warning: cannot select font 'CW'"
+  * xzdec: Add support for Linux Landlock ABI version 4. xz already
+    had the v3-to-v4 change but it had been forgotten from xzdec.
+
+-------------------------------------------------------------------
+Fri Apr 12 16:22:12 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- revert the switch to tar_scm which dropped the signature
+  validation
+- switch back to tarballs because the upstream tarballs are not
+  gone
+- reinstanciate keyring from Lasse
+- go back to the last release signed by Lasse (5.4.2)
+- revert multibuild, drop service and rpmlintrc
+- use real_ver for the Source, move everything else back to
+  %version like before the hectic XZ downgrade
+- remove payload setting, we are using zstd now
+
+-------------------------------------------------------------------
+Thu Apr  4 07:16:46 UTC 2024 - Dan Čermák <dcermak@suse.com>
+
+- Switch to using tar_scm for fetching the sources as the upstream
+  tarballs on github are gone
+- introduce _multibuild to allow building the translations outside
+  of Ring0 and everything else in Ring0
+- add rpmlintrc to silence harmless warnings
+
+-------------------------------------------------------------------
+Thu Mar 28 13:51:05 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- restore a bigger version number so that update works
+
+-------------------------------------------------------------------
+Mon Jan 29 21:36:02 UTC 2024 - Danilo Spinella <danilo.spinella@suse.com>
+
+- Build static library on SLE
+
+-------------------------------------------------------------------
+Sun Jan 28 10:10:07 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 5.4.6:
+  * Fixed a bug involving internal function pointers in liblzma
+    not being initialized to NULL. The bug can only be
+    triggered if lzma_filters_update() is called on a LZMA1
+    encoder, so it does not affect xz or any application known
+    to us that uses liblzma.
+  * Fixed a regression introduced in 5.4.2 that caused
+    encoding in the raw format to unnecessarily fail if --suffix
+    was not used. For instance, the following command no longer
+    reports that --suffix must be used:
+      echo foo | xz --format=raw --lzma2 | wc -c
+  * Fixed an issue on MinGW-w64 builds that prevented
+    reading from or writing to non-terminal character devices
+    like NUL.
+  * Added a new test.
+
+-------------------------------------------------------------------
+Tue Nov  7 16:10:26 UTC 2023 - Andrea Manzini <andrea.manzini@suse.com>
+
+- Update to version 5.4.5:
+  * liblzma:
+      - Fixed an assertion failure that could be triggered by a large
+        unpadded_size argument. It was verified that there was no
+        other bug than the assertion failure.
+
+      - Fixed a bug that prevented building with Windows Vista
+        threading when __attribute__((__constructor__)) is not
+        supported.
+
+  * xz now properly handles special files such as "con" or "nul" on
+    Windows. Before this fix, the following wrote "foo" to the
+    console and deleted the input file "con_xz":
+
+        echo foo | xz > con_xz
+        xz --suffix=_xz --decompress con_xz
+
+  * Small fixes and improvements to the tests.
+  * Updated translations: Chinese (simplified) and Esperanto.
+
+-------------------------------------------------------------------
+Wed Aug 16 13:58:09 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- xznew: Remove bashsism.
+- build: pass CONFIG_SHELL=/bin/sh to configure: the posix tools
+  are setting the current SHELL as the shebang, which is overkill:
+  any posix compliant shell, aka /bin/sh, is sufficient.
+
+-------------------------------------------------------------------
+Thu Aug  3 07:01:39 UTC 2023 - Paolo Stivanin <info@paolostivanin.com>
+
+- Update to version 5.4.4:
+  * liblzma and xzdec can now build against WASI SDK when threading
+    support is disabled. xz and tests don't build yet.
+  * documentation update
+  * translations update
+
 -------------------------------------------------------------------
 Fri May  5 05:47:01 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>
 

xz.keyring

@@ -1,52 +1,52 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 
-mQINBGOsX3EBEADZxyfiZVg7aub+JoBG+sPChHUwbJc+SH7BWOPbu4HLNfk6ZUzi
+mQINBEzEOZIBEACxg/IuXERlDB48JBWmF4NxNUuuup1IhJAJyFGFSKh3OGAO2Ard
-/JSBYIGIIrqGkA60Pu1CbplkVF4UG0YBAAE/j11puWMHrydxTY9Hoc/rYOBq+0AE
+sNuRLjANsFXA7m7P5eTFcG+BoHHuAVYmKnI3PPZtHVLnUt4pGItPczQZ2BE1WpcI
-mWnG0VINjpF3dNGlrmlikORzpW/FAHy8B1nD8P7vulPooc9FgkOmFM8nAP24TURU
+ayjGTBJeKItX3Npqg9D/odO9WWS1i3FQPVdrLn0YH37/BA66jeMQCRo7g7GLpaNf
-h8G8cGY0jqpVxTiQqAi9KPxTlnY5s7hhgW0Nd3mIF4QSoPofMPnV5DTYS1LJw6XB
+IrvYGsqTbxCwsmA37rpE7oyU4Yrf74HT091WBsRIoq/MelhbxTDMR8eu/dUGZQVc
-9K3DR4bsD7YYF2TdYGvlk/bJNu9DB1NuiWjpnzLIkPdtxpcPORXgiWE6wvzFncJn
+Kj3lN55RepwWwUUKyqarY0zMt4HkFJ7v7yRL+Cvzy92Ouv4Wf2FlhNtEs5LE4Tax
-G5tqbdQ//ylZAjOFbCntMMO7ve3JXWjEM6mDEuqlmlaHrF21Y+mQN5i2BdRKfMiQ
+W0PO5AEmUoKjX87SezQK0f652018b4u6Ex52cY7p+n5TII/UyoowH6+tY8UHo9yb
-HB9KsveTz2Ev4cO9Tblzsm/oDvYR29LORjJl3PE3jqNSVbABih2OGnMAS9345a5u
+fStrqgNE/mY2bhA6+AwCaOUGsFzVVPTbjtxL3HacUP/jlA1h78V8VTvTs5d55iG7
-n1vyP3x6/oAyZ7Q0iKzZml47nsl40dQk4z3aJp9ya3lph5ANQP3uzwQtDSZgkDy/
+jSqR9o05wje8rwNiXXK0xtiJahyNzL97Kn/DgPSqPIi45G+8nxWSPFM5eunBKRl9
-JDyIL/z19FtAgA7QugWkx4HsSzmZnE5GQJImA0/XxXYNck2NqQ9YJ/RY8W3aD4dp
+vAnsvwrdPRsR6YR3uMHTuVhQX9/CY891MHkaZJ6wydWtKt3yQwJLYqwo5d4DwnUX
-mnFAYE1Yi5kutrVlfqzKujBpi3/JfSM1hkJdcRJ7rrOw69JXVvbqVW1EiX8gp8Ka
+CduUwSKv+6RmtWI5ZmTQYOcBRcZyGKml9X9Q8iSbm6cnpFXmLrNQwCJN+D3SiYGc
-GV6g0MN/G15dJT/AMY9/XwEFIYP7vZl32Qx7A67jokNB7bKCZxWexppRrQARAQAB
+MtbltZo0ysPMa6Xj5xFaYqWk/BI4iLb2Gs+ByGo/+a0Eq4XYBMOpitNniQARAQAB
-tBxKaWEgVGFuIDxqaWF0MDIxOEBnbWFpbC5jb20+iQJUBBMBCgA+FiEEItRl8rTB
+tCdMYXNzZSBDb2xsaW4gPGxhc3NlLmNvbGxpbkB0dWthYW5pLm9yZz6JAlEEEwEK
-c4A7IMbeWfzyB/6n9EUFAmOsX3ECGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwEC
+ADsCGwMCHgECF4AECwkIBwMVCggFFgIDAQAWIQQ2kMJAzlG0Zw0wrRw47nV9aRhG
-HgECF4AACgkQWfzyB/6n9EXJkhAAvvfTCu2w8FReaAv954ublcN6SFBuyXcXPeNZ
+IAUCZZwJyQUJGuHiNwAKCRA47nV9aRhGIE4qD/4jdFTe3WPpLgvz/jdlbnSZxr7q
-46ZBm6LfMErbj6wGyLzXiU3WMuPvwDliX5/Etkhj+juj/XlAK7DtRUa8Jf6R2u1o
+OS6H/ZJFENHO4SbavXdoXLtj+t6/lqWq890Js8IpWaaiJLowzW1xJMEg99W6k0KD
-FaGodx63gjzEoOXrSYoWt1ANwADLnMp5MT1P14PHJcCKSyj2qcVOaKVvWYRw2Yeo
+3pHUbwPxf0GCSAt/W4JYxdTj+1ggdHjx5yBAmOakjnOH+ZDKQNBnDOI6ghf3ew+H
-Kd8tc0Wcm2NPxCk+nzUVPT8bO62kJN4pnalWA3ultozZiSoqcMelwI8czYUY3TiB
+9z/b0mQX3rlQbtoqSPZtuDOdFcjCOSwEyqdV+9eNqnv2CoKZkiGoUB1WGCbqKUkY
-L+FqOUR2438TFnWDGnaI37ZXkjTYSEIRuneo3vjLcJDmSwrdyL3NsIbXySnN8ga3
+KiUJ3WldmPQ5RQYjEi7zZWVac1VuwBA0XOku+W4cCJ5DnPyK7CtMwC84VvaodlOX
-kZi6hgjIS/Th3KhKzyWpuj9ydBMAMniYUBRFbKl/pH8PtzQ258ToxVjiG/hBrEbq
+UAK3Y5BIZpZM2Rk6yMX5lFDA5nA8UuHJQRDjTVmh3BIdgRvp0ZV6ogtqNE7RifpW
-X0P8RyAd6YiiHDOPjPqj1lnNeeliIytBtHzH1HB3a2Eg5ZY7iG4DMg82IU/qcL9l
+aBWDIsCkimcbCJJM+edOLiVZog+ia1Ts8zu33wj7Tnvp5znLc8NLZIqwu1HKLS97
-aPHslYi93LhvaUR+APAjhd71PAexXxQkEtsUOPPybFTCVrG679RCLeV4M32PZ99c
+m+Yf5oC3ObTZtXbVF+OglWe/3ljLHdL2bJxNdtcVlChSNPUW3fgLHk9Fzrlnqdab
-BGY0ekPo653ITaAwBQyZJvAVsP5A0gbRPYok/c/qE+lfF8UuPPyUOBk0IYyiA4MR
+tSGwI/0Ryt00cKjRiMOagTn5Nly6boCtgGYdQafQoSrs3eQjnWVgbNYDMgPyl4k+
-W7qSu2gFkOHT5yJgyd7MtvzJvzVnt3kTQCsQdNGAIZ8NTx6PbWj9qtSmpXz3H+XR
+Q5RJLEY7AvtXo7FUEgOTfr9PWmjmc2JzGpxbtwl6sQi6yLrBZTRf1Xao2OjOje6G
-JH/9xvXhL3v22q82uBfAEMk3h31KFESGo5pwarthwfQvQL/6MumdLJELXzijAY0v
+XdUbXNmgOv16sWxcI0s4lX1z28BgHQfwXhBFBRjw2Sy+6TfFXjX24thcpMwvyJ3c
-w9nxEOW5Ag0EY6xfcQEQANCo3Vf8eHyTlhvusQ4inItxocgY06JhgBCkw9m/YiVI
+xhMtdY4N4jyfRjYe8LkCDQRMxDmSARAAv8XAp2PGA/G1KmCrVIzOBm1NPIuqGAYP
-0Pekf0WatCy1fNIJJlyNgjQGQ+37pLP6d2xwzdJc8Gm15bGlfrth5aYfNdcBLR1S
+c1l9p0dYdhEgvfw0NXcl5MDv1jbOPZ2PspA8NP7Rqp6LNNXYTeM/eIJDndU5Phyi
-MJ7JnX0zcjRiPwI+Z8XAVoGu7vzGIScEopDMiI4xTdc7GlgPyE27Gd2A0MwzR2lQ
+ewFpACAp7Gmm2dL5PUOhu0gIUnQYbN/QdGPoo7bNI646K1Y9aVTBu9fszQssjb6G
-i03aSLloXh6h+j7GL4C3fYg+/Xct/w5d1stNWDpqOl3BQqrcT9PcvhZTSC93g4YW
+qXHSNM+pskVn9lropO1tLrF0I9VSlSphlCmiQRlzBCZSnxD6UagkPaw1gJnJqnrd
-hBFNZiYFL0pMg+Wg62/yJ49mjWOkcPKdhKmWDOx6vV88Pabwxh+sSKaWh3DZ23pW
+f9oA6AIavZFdh104fl7y8bMZb6bC0K/5ZD0DLfmYaojkyqRtl3VBu6/ZvXrjsT9A
-iMohEN0tynwMIK1DT4D7BxuP4gCKhPkfxcL8dMkFHbqdgfUEgdDr1Ritxt4El3AZ
+QS5x9EdVslUoYY+kUxQm1wi3LIi3mOj6v0IIvgKzjt0X/39E3C42+m8ddTKowFB1
-oCk3GSc0uESAWp1NQcM7ZiuWlmT90I0cHPmfxJLV6tRIM0iCxmowuVGQP82/qbT1
+Y1lEzHiT80YP9a+I+L2bqYgy6Lqs5CxI5qph1xRfg2rY6uvc5rPYk9B1R94jbeKi
-C6G66HgRMmA5CnaUsDa1vVxMF8trdU8Pkr6OpPn12gmwz31j1JxvSq4RwSxLl77w
+3W8ryHG9QJBNXcd8mCGLM3qylWXTJA4oGITyaIlGCuMeKUfeFNvGijjbEOQ0Cr4J
-H3kTJY3qO/lMYhqx0+mK57CPaYsjoqA5xnqzVdtwfJI3tPwttlrjfoDQSn2baZu5
+CjdACbWJsPEoIOrRFxY+NwJEA39Dkyalyh2l0qTNXTIYhLiDuzl+tWuBX+SjHavj
-9pvYC/IVxOgjTiyIguS8LSBj08iOqZLoLBuqPDzkQwvcCL8TcxEde2yoDi6wI+Ws
+9jGyvwr3T37gfzYCNMoZf8GaxAUJMCoGTqnsjTPGMion/DfdNkFDQ+fivdYiVQ9p
-XevpBcY2fkItqcRDiPQJ7FuEAnRAa8SfcFLUG9cwHg7RmeSp5WrfOw+7xdqj1ImF
+/Njpr38sC83V8dHF/1KkIHImyzMPTdC7l/lMHyC2Gx2dWZOjuOOKit0Qoy3DZoQw
-ABEBAAGJAjwEGAEKACYWIQQi1GXytMFzgDsgxt5Z/PIH/qf0RQUCY6xfcQIbDAUJ
+vN1ZZND9M1UAEQEAAYkCPAQYAQoAJgIbDBYhBDaQwkDOUbRnDTCtHDjudX1pGEYg
-CWYBgAAKCRBZ/PIH/qf0RW8dD/9tQqJ4bcRXLPXrQzbBiMpRBiLqRxlpeS2nwFUr
+BQJlnAmyBQka4eIgAAoJEDjudX1pGEYguyYQAJo+5SnMMdu+d70mWfUb9PZg7P5C
-ryv7JCbAbgZ4GqKa3tR/5oUfICZwgSJhVUMeFfUtDAOuLVRBEHAksVxztUxpAVzF
+GRepHnckx9Sis5oR5s7NNl5j5Yy4J1UwsmrP+mn52ujqewkkVsCq65NGQQx7+tkw
-2tH6ZrvTI26tzFQw5U+xrTEl3eazNgZF6Qsqv5313RI8SrUAhv95s0A8CdVIi3RZ
+uKGvnGBkHdrI+aJk86qLMf4DlnNJEmN8t5jTGQfRLbFVf2I8EY6qXAzCSmL9Zs++
-5LPPsoT/XggtaSz28iSaZxDChjY5jNNvC8sjp445+egpglXxjR24otShUDaZLd6Y
+rDUz65GOTB1EP0XmBRsuVYRfDbFezrPQH0JDucbXFi/2BDnl2/Mk9NBoQ0CvB4oG
-LfMHTR1raOoIZd8lbRoUAJ32vkXu2UUPgI6GC0HaEyHQQ3faG5SGUrcWuA6XOD9p
+tLDiQZ+jV7n1VXXJ1faD9s7i0hOTdcG6rlyIqi/LyAzdCnOYTkmv3U1kdmzkvrh1
-7Xtu3SDgAUE6gbxUeCQWiFm2c+dEoldtr4n3BXIOOKfPHi/hiNVDmGWzPsB2XzCb
+KEiejnM5fj27RE2v191vh3hgZ+X5+uwjNTP0QC4qP8XykQOAA8usOMVZ72lyXCAk
-oUPHfWj4p54I+IFf+wt3IuR0H9OqXipL/9yE2cHkp7zaIVuc43xPa2FVOkJL0XnF
+wiUcRdrAXLN/XbIFNcQ3m4d3W6t60Gk09wFlUKaEltDMlPUsxiSG3qFwFGPBP6UV
-M67tSMKVaKFA6myewHDrteBDyZVt4IH8clejhs6cwWOf9DOcbPQO1C94vMc+Glah
+h3mjJMAl1jltLrR7ybez0SczfrcAtdCsKTvgzV9W2TzUfK2R9PBanmXTXK2M7yU3
-oCL0FGS1mU/CumiNB1zCP0o29IUXQvLk/mM8w/zL65sfilbfm7kLk1l8UOy/pUxk
+IquHt3Je4aSP7XYb5D+ajlbFNvnXOYcai8WryfC5nLAfV4MbPX+UlRaYCqqHVhut
-4U9Kpv79Z7aIUwSZVXkkfQuHlmGCm0y6QKLTaZQL68uDXrMpWO2O2B+tOCJibGFz
+gK93re1L5mMI3zjG5Ri5jLpUA9toSJCIJIY5zwr/8LL/ZL4TixXlouA17yjkpY/e
-ecPedd7w77GKqjMHXcVX3Hd2wnZAMTwIJsjHG4qO/LfA8jze5+Ohd3qzilP7ziwm
+Bjs8cNj1O3aM4jY2FKCS8UbfxOiARk/5kBMRPEZ/mqpMQttzE8KVjOv6fRxy/eVE
-aK5MKg==
+888/gToe5kb8qYwy
-=d3XT
+=6rZC
 -----END PGP PUBLIC KEY BLOCK-----

xz.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package xz
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,18 +17,23 @@
 
 
 # avoid bootstrapping problem
-%define _binary_payload w9.bzdio
+%if 0%{?suse_version} == 1500
+%bcond_without static
+%else
+%bcond_with static
+%endif
+
 Name:           xz
-Version:        5.4.3
+Version:        5.6.2
 Release:        0
 Summary:        A Program for Compressing Files with the Lempel–Ziv–Markov algorithm
-License:        GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND SUSE-Public-Domain
+License:        0BSD AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later
 Group:          Productivity/Archiving/Compression
 URL:            https://tukaani.org/xz/
-Source0:        https://tukaani.org/xz/%{name}-%{version}.tar.gz
+Source0:        https://github.com/tukaani-project/xz/releases/download/v%{version}/xz-%{version}.tar.xz
-Source1:        https://tukaani.org/xz/%{name}-%{version}.tar.gz.sig
+Source1:        https://github.com/tukaani-project/xz/releases/download/v%{version}/xz-%{version}.tar.xz.sig
 Source2:        baselibs.conf
-Source3:        https://tukaani.org/misc/jia_tan_pubkey.txt#/%{name}.keyring
+Source3:        https://tukaani.org/misc/lasse_collin_pubkey.txt#/xz.keyring
 Source4:        xznew
 Source5:        xznew.1
 BuildRequires:  pkgconfig
@@ -49,11 +54,12 @@ The xz command is a program for compressing files.
   decompressing speed.
 * Very similar command line interface to what gzip and bzip2 have.
 
+
 %lang_package
 
 %package -n liblzma5
 Summary:        Lempel–Ziv–Markov chain algorithm compression library
-License:        SUSE-Public-Domain
+License:        0BSD
 Group:          System/Libraries
 
 %description -n liblzma5
@@ -61,7 +67,7 @@ Library for encoding/decoding LZMA files.
 
 %package devel
 Summary:        Development package for the LZMA library
-License:        SUSE-Public-Domain
+License:        0BSD
 Group:          Development/Libraries/C and C++
 Requires:       liblzma5 = %{version}
 Provides:       lzma-devel = %{version}
@@ -73,17 +79,39 @@ Obsoletes:      lzma-alpha-devel < %{version}
 This package contains the header files and libraries needed for
 compiling programs using the LZMA library.
 
+%if %{with static}
+%package static-devel
+Summary:        Static version of LZMA library
+License:        SUSE-Public-Domain
+Group:          Development/Libraries/C and C++
+Requires:       xz-devel = %{version}
+
+%description static-devel
+Static library for the LZMA library
+%endif
+
 %prep
-%autosetup
+%autosetup -p1
 
 %build
 %global _lto_cflags %{_lto_cflags} -ffat-lto-objects
 export CFLAGS="%{optflags} -D_REENTRANT -pipe -fPIE"
 export LDFLAGS="-Wl,-z,relro,-z,now -pie"
+
+# Either we build it without pic enabled, or we build one at a time
+%if %{with static}
 %configure \
   --with-pic \
   --docdir=%{_docdir}/%{name} \
-  --disable-static
+  --disable-shared CONFIG_SHELL=/bin/sh
+
+%make_build
+cp ./src/liblzma/.libs/liblzma.a liblzma.a
+%endif
+%configure \
+  --with-pic \
+  --docdir=%{_docdir}/%{name} \
+  --disable-static CONFIG_SHELL=/bin/sh
 %if 0%{?do_profiling}
   %make_build CFLAGS="${CFLAGS} %{cflags_profile_generate}"
   %make_build
@@ -102,20 +130,14 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %find_lang %{name} --all-name --with-man
 install -Dpm 0755 %{SOURCE4} %{buildroot}%{_bindir}/xznew
 install -Dpm 0644 %{SOURCE5} %{buildroot}%{_mandir}/man1/xznew.1
+%if %{with static}
+install -Dpm 0644 liblzma.a %{buildroot}%{_libdir}/
+%endif
 rm -vf %{buildroot}%{_docdir}/%{name}/{COPYING,COPYING.GPLv2}
 
 %post -n liblzma5 -p /sbin/ldconfig
 %postun -n liblzma5 -p /sbin/ldconfig
 
-%files lang -f %{name}.lang
-%dir %{_mandir}/fr
-%dir %{_mandir}/de
-%dir %{_mandir}/ko
-%if 0%{?suse_version} == 1500
-%dir %{_mandir}/ro
-%dir %{_mandir}/uk
-%endif
-
 %files
 %license COPYING COPYING.GPLv2
 %{_docdir}/%{name}
@@ -168,6 +190,15 @@ rm -vf %{buildroot}%{_docdir}/%{name}/{COPYING,COPYING.GPLv2}
 %{_mandir}/man1/xzmore.1%{?ext_man}
 %{_mandir}/man1/xznew.1%{?ext_man}
 
+%files lang -f %{name}.lang
+%dir %{_mandir}/fr
+%dir %{_mandir}/de
+%dir %{_mandir}/ko
+%if 0%{?suse_version} == 1500
+%dir %{_mandir}/ro
+%dir %{_mandir}/uk
+%endif
+
 %files -n liblzma5
 %{_libdir}/liblzma.so.5*
 
@@ -178,4 +209,10 @@ rm -vf %{buildroot}%{_docdir}/%{name}/{COPYING,COPYING.GPLv2}
 %{_libdir}/liblzma.so
 %{_libdir}/pkgconfig/liblzma.pc
 
+%if %{with static}
+%files static-devel
+%defattr(-, root, root)
+%{_libdir}/liblzma.a
+%endif
+
 %changelog

xznew

@@ -52,7 +52,7 @@ if test -z "$cpmod" && ${TOUCH-touch} -r $tmp/1 $tmp/2 2>/dev/null; then
 fi
 
 # check about xz extension
-xz $tmp/1 &> /dev/null
+xz $tmp/1 > /dev/null 2>&1
 ext=`echo $tmp/1* | sed "s|$tmp/1||"`
 rm -rf $tmp/
 trap - 0 1 2 3 6 13 15